Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Control Web Panel 1.16 Clear all filters
TI-2026-83869 CVE-2026-77880 · GHSA-36qx-jxpf-r368

OS command injection in Control Web Panel password route

Priority LOW 38

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root.

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00789 Published 2026-11-02 Fixed in 1.16 CWE-78
TI-2026-83868 CVE-2026-77879 · GHSA-hcj5-rpjg-pm72

SQL injection in Control Web Panel access_token() API

Priority HIGH 72

Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled val…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00218 Published 2026-11-02 Fixed in 1.16 CWE-89
TI-2026-83865 CVE-2026-77876 · GHSA-94wp-xcc5-c3cm

OS command injection in Control Web Panel protected_directory module

Priority MEDIUM 42

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by submitting unescaped…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.02251 Published 2026-11-02 Fixed in 1.16 CWE-78
TI-2026-83861 CVE-2026-73697 · GHSA-rfph-hxj5-v269

File write and command injection in Control Web Panel phpini_editor

Priority MEDIUM 43

Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01809 Published 2026-11-02 Fixed in 1.16 CWE-22
TI-2026-83859 CVE-2026-73695 · GHSA-m2m4-55x5-x967

Path traversal in Control Web Panel enables local file inclusion

Priority LOW 39

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00952 Published 2026-11-02 Fixed in 1.16 CWE-98